Deep DiveBy the PhishSheriff team · January 2025 · 11 min read

Healthcare Under Siege: Ransomware, Phishing, and HIPAA Exposure

Healthcare organisations face costly breaches and a demanding regulatory environment. This analysis looks at why clinical staff are targeted, how phone and email attacks combine, and what a phishing programme designed for healthcare looks like in practice.

Key points

Why electronic health record credentials are a prime target
Phone-based attacks impersonating IT helpdesks and insurers
What an auditable awareness programme needs to show
Design principles for programmes that respect clinical time

On this page

Why healthcare pays a high price

Healthcare has consistently reported some of the highest breach costs of any sector, and the reasons are structural. Medical records are valuable to criminals for longer than card numbers: a card can be cancelled in days, but identity, insurance and clinical history can fuel fraud for years. Ransomware pressure is acute because downtime affects patient care.

The operating environment also limits conventional controls. Clinical workflows cannot tolerate friction at the bedside, some medical devices run hard-to-patch systems, and the workforce includes physicians, nurses, locums, students and third-party billing staff with very different access. When technical controls are constrained, people carry more of the defensive load.

Health record credentials: the real target

Credential phishing aimed at hospital staff often seeks access to electronic health records. A single login can expose patient demographics, insurance details and prescribing workflows, and in poorly segmented networks it can be a starting point for ransomware.

Lures reflect this. Fake session-timeout notices, counterfeit single-sign-on pages timed to shift changes and spoofed messages about certificate renewals are designed for staff who read email in short gaps between patients, on shared workstations. A healthcare simulation programme that sends generic parcel-delivery lures is not testing the risks that matter; exercises should reflect the clinical-context lures staff actually see.

Beyond email: the helpdesk and the ward

Hospitals rely on the phone for urgent clinical matters, which makes phone-based social engineering effective. Two patterns are common. The first impersonates the IT helpdesk and asks the employee to read out a code from their screen, which can defeat otherwise sound multi-factor authentication. The second impersonates insurers or payers, targeting billing and patient-access staff to obtain patient data or redirect payments.

These calls often follow an email that sets up the expectation, such as “an analyst will call you about the flagged claims”. Email security never sees the call. Rehearsing the email-then-call pattern with the staff who face it helps them practise verifying a caller before acting.

HIPAA and the auditable awareness programme

The HIPAA Security Rule requires a security awareness and training programme for all workforce members, and enforcement actions by the HHS Office for Civil Rights have cited weaknesses in risk management and training after breaches. In practice, an auditable programme benefits from four kinds of record: coverage across the workforce, including contractors and students; content mapped to actual threats such as phishing, phone fraud and handling of patient data; outcomes measured over time; and evidence of follow-up for people who need more support.

Simulation results can help demonstrate outcomes and follow-up. They support a compliance programme; training alone does not establish HIPAA compliance. In healthcare, agree simulation scenarios with clinical leadership and privacy officers before launch, make sure no real patient data is ever used, and present the programme as patient-safety practice rather than employee testing.

Design principles for a healthcare programme

A few principles separate healthcare programmes that change behaviour from those that create resentment. Respect clinical time: short learning, delivered close to the moment it is relevant, works better than long scheduled modules. Reflect the real threats: health records, prescribing, payer and helpdesk scenarios across email, phone, SMS and QR codes. Exempt no one: attackers do not exempt physicians or executives. Publish trends, not blame: department trends encourage local ownership, while individual results stay between the person, the platform and their training.

Finally, connect the people programme to the domain layer. Hospitals send email from many systems, including patient portals, appointment reminders, lab notifications and fundraising platforms, and each unauthenticated sender weakens trust in the hospital’s domain. DMARC enforcement helps receiving systems reject mail that falsely uses the hospital’s domain, while awareness work prepares staff for messages that imitate someone else.